Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGM-00000000Ail-0tP7

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:06 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a14-57.smtp-out.amazonses.com ([54.240.14.57]:59545)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13ba4a94-b037d1e5-b836-40d7-a4c9-6f2bf62d0bf0-000000@send.updates.abodereader.com>)

id 1weCka-0000000064z-3C5r

for root@nk.ca;

Mon, 29 Jun 2026 08:14:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=updates.abodereader.com; t=1782742403;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=VLIdqf7k1ECf3AKHaixB3DeTGviheVApv14SLv1UhTU=;

b=PO5RXIglL9sQ3w0w2KtsUC/r8yDgqHVOF6rH12OZDyJpPO4KrxFFH/OmiULjyczZ

mCi2c2tz2ITBYTirmzKfrqOPEAqqJg2FtQw9RJdUxXPr1wDNVdKnlQj/cJnuxAVaf2v

A15obIMJVzWSK+czxMnuDfmDtOojp4NMu0QBNERg=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742403;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=VLIdqf7k1ECf3AKHaixB3DeTGviheVApv14SLv1UhTU=;

b=ViccElIl1YmE/qdtWAevNoOrVn8TLO6qFz3mGjfP8ttyhRrTc5PjgVTWAB+LuqfQ

p3GWqzRanOZ80VEes49QGa+ZZYZ/ZhkRtn9zpGkA0JPJv1iKv6ziysNmdKtXT1I+bK/

7y/BDEEa+i7ZC/QlG5XLZ1QBqES9HIRrKtVagDnM=

From: DocuSign

To: root@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13ba4a94-b037d1e5-b836-40d7-a4c9-6f2bf62d0bf0-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:13:23 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-1f72ff7c4ff28ae9-Part_1"

Feedback-ID: :1.us-east-1.JjpWZXhkc+hAx/1QFiBBGfqtcUWSdRo6a3Sgkmv86ckHPV0LelUjeS8iu0mBcWOyykDqpHVwju04db6Aer9xzulXHbyGOB9gmHuKcfJdI6tp2bYT9osSWvhwtiHAVe9ogrY78eeHjESQ5sOfO7exZvZ/tkujmd9q0G6QVH4QBc0=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.14.57

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=cm9vdEBuay5jYQ

Do Not Share This Email



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.14.57 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.14.57 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.14.57 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2





----_NmP-523b8a454a848e68-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dcm9vdEBubDJrLmNh



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nl2k.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-523b8a454a848e68-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






t=3Dcm9vdEBubDJrLmNh" style=3D"display:inline-block;background:#735AFF;colo=

r:#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius=

:8px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nl2k.ca using DocuSign. If you wish =

to stop receiving emails, contact the sender.













----_NmP-523b8a454a848e68-Part_1--

Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGI-00000000AiB-12Mg

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:02 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a10-10.smtp-out.amazonses.com ([54.240.10.10]:60581)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13b62e6d-f663af18-0d01-4c8f-8767-35fc98acd54e-000000@send.mail.drafft.site>)

id 1weCgH-00000000KyH-1CFc

for root@nl2k.ca;

Mon, 29 Jun 2026 08:09:57 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.drafft.site; t=1782742134;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=MaZF8tYF7zkaIuSJp/iKaSl7M3o/1mku16leQTyWX58=;

b=6sljJi31jbB6yG1wi8WJ5zmo7e8UaOK8VqNgDe/HcdU0Zqin5ZfQyM/fzjFBISK3

E8VRig4HVqSCqlKpqeU4pdEHsToy3OPC66d5GkZXk7byuWf9klJiONbFTRg6NXVSa9V

qu15HQsPXgc4SpQcCW/AQ/skPxeswGxaw5hUoaFE=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742134;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=MaZF8tYF7zkaIuSJp/iKaSl7M3o/1mku16leQTyWX58=;

b=mvIln9oNpLAg0xIbSMiD7NiOycxgb/iiOaORMkvemNYQHETU1rR9ucObcj/sYMVl

2+C6cDOA4YP2/C0wIoFmRcW4iYcCzFojkcdgrtnTsiI8YgUcf1gyYyAfWuIeI4J3x6D

SeOYGRuHwtRssWZoVU7aSED7vrI9ILQPcwkr3ZJI=

From: DocuSign

To: root@nl2k.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13b62e6d-f663af18-0d01-4c8f-8767-35fc98acd54e-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:08:54 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-523b8a454a848e68-Part_1"

Feedback-ID: :1.us-east-1.024kA0Mzc16XjNTEGOXUSs+c/2RKCVLbTaL7GWXm6VYI/mhiu2ZfOLGoE/Olfpn4p1YoSmlzOJJommLzrQfbeV8VtZLAQtYAd9hA4kVhKrKTP8ZGzAvr8AWJNE8wsAOJSsBi+YSpgfgrXCkkG4XFG4Au7nEq17/IL1vgLhn9RLY=:1.us-east-1.epbACCJLarUaEI78XZoGREJ9LamRjxMH5pM2kZb64rA=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.10.10

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=cm9vdEBubDJrLmNh

Do Not Share This Email



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.10.10 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.10.10 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.10.10 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2





----_NmP-cd5c0b696f96855a-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://s3.us-east-2.=

amazonaws.com/adobedocumentsign.blob.core.windows.net.=

web1016754684231/index.html?s=3Dwww@nl2k.ab.ca



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nl2k.ab.=

ca using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-cd5c0b696f96855a-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






com/adobedocumentsign.blob.core.windows.net.web1016754684231/index.html?=

s=3Dwww@nl2k.ab.ca" style=3D"display:inline-block;background:#735AFF;color:=

#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:8=

px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nl2k.ab.ca using DocuSign. If you =

wish to stop receiving emails, contact the sender.













----_NmP-cd5c0b696f96855a-Part_1--

Docusign phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDFy-00000000AfI-16xd

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:46:42 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:46:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-39.smtp-out.amazonses.com ([54.240.9.39]:52639)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f1391506a-fff84bac-f005-4ab4-abeb-205fe5540fab-000000@send.mail.relayza.com>)

id 1weC3H-00000000Fdv-2ci0

for www@nl2k.ab.ca;

Mon, 29 Jun 2026 07:29:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.relayza.com; t=1782739718;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=dto4A12oJqxVR6ZHoyjDiX826UyVm2OSt6BDno5m1N8=;

b=jomUqGor6TblVScmiNXyqkhWrrUJ8t88PRtlt3+lhR2VrE+n7r8+RaqfppRD/fC7

9nY+YapccqTRYWCrO82SXlutkNgisC3si8mQvcvwNd5hMsIkO+txMaJLMxTuriVT4gx

AmZZ7ed7R81ooApef9N+esRPRWWCvgWE98MBor1Y=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782739718;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=dto4A12oJqxVR6ZHoyjDiX826UyVm2OSt6BDno5m1N8=;

b=E7jGg5hPJwfRbsMIQIKCmlUaONZzVE8zw3G9UQ6aS69/KjCfIcfcY6f0kJ95IW+2

o33afXI49NPAe2BYqwHksWHZA1KTGt55vE6N5OFDKa+EJV1cvP+9D9FDvtavQIeJKMR

JIYBwnO8QokA7KGwldcbSxe6C1HgOy+W8jg0BHvQ=

From: DocuSign

To: www@nl2k.ab.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f1391506a-fff84bac-f005-4ab4-abeb-205fe5540fab-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 13:28:38 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-cd5c0b696f96855a-Part_1"

Feedback-ID: :1.us-east-1.Ovct7LTmv/oD6KlfgKSgBWcjD4h08vDb249uZd+hxe52hfiAXJZ0GJLTCZ1XFQR7wFKW2yjK90PdW+N9+hrend/94faXJ54IoK9f5Lg8ROo2cqWckqgnouTiYQyp67wpiXxtTF8UWAxyURb19LFeAoyRMVk9ZL4oiKq3nbReH4g=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.39

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://s3.us-east-2.amazonaws.com/adobedocumentsign.blob.core.windows.net.web1016754684231/index.html?s=www@nl2k.ab.ca

Do Not Share This Email



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

[54.240.9.39 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.39 listed in dnsbl.ahbl.org]

[54.240.9.39 listed in dnsbl.ahbl.org]

[54.240.9.39 listed in dnsbl.ahbl.org]

[54.240.9.39 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.39 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.39 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.39 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.39 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.39 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: relayza.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: mail.relayza.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.39 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.9.39 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign phish from Amazon PArt 2



----_NmP-77cf8d388c9d9b24-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://s3.us-east-2.=

amazonaws.com/adobedocumentsign.blob.core.windows.net.=

web1016754684231/index.html?s=3Droot@nl2k.ab.ca



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nl2k.ab.=

ca using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-77cf8d388c9d9b24-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






com/adobedocumentsign.blob.core.windows.net.web1016754684231/index.html?=

s=3Droot@nl2k.ab.ca" style=3D"display:inline-block;background:#735AFF;color=

:#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:=

8px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nl2k.ab.ca using DocuSign. If you =

wish to stop receiving emails, contact the sender.













----_NmP-77cf8d388c9d9b24-Part_1--

Docusign phish from Amazon PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 07:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weBvx-00000000Cnd-3YWf

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 07:21:57 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 07:21:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-5.smtp-out.amazonses.com ([54.240.9.5]:48489)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f138886ce-ee79ee22-bfbb-49a8-9e07-f2b6ab7d6ae7-000000@send.information.glmilks.com>)

id 1weBu0-000000009Oa-2pEH

for root@nl2k.ab.ca;

Mon, 29 Jun 2026 07:20:04 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=information.glmilks.com; t=1782739142;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=1xCrO6sb1uqC3ZmA+l51/XYCISoVPSbTaCCBY83bbco=;

b=FByJwz9oynKmPqSzlgGKqwgfbQX42oZk61J81EuuNXb/nIYgzaAeoI01zOmW9uLp

GL6xoI+GiTLJdARzaAnBQ7aVALJDhSDKjW3PwcSZX9/a4PanUoofuXpcCgnsKNxWfM4

0XQEncjADAjtFcCL2fdw1bxMLpdeRTBhCoJRiGXM=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782739142;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=1xCrO6sb1uqC3ZmA+l51/XYCISoVPSbTaCCBY83bbco=;

b=kcyUt8WVudnj8gijh9UZfs3RNJsXmaolC47cZDqJYsiPSnN46Hb40X3IAYczTA1d

hsSQNb5X/Dp6TMqcNJzH7S577EREXaMWi8h7LdV8QmzvR1DjyyNK9VQqhrYtgCu+kHM

hGCYrUPqzxOMUOkFpqB2duyXZwA9dtNtozUuUZtk=

From: DocuSign

To: root@nl2k.ab.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f138886ce-ee79ee22-bfbb-49a8-9e07-f2b6ab7d6ae7-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 13:19:02 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-77cf8d388c9d9b24-Part_1"

Feedback-ID: :1.us-east-1.bfDW8J0E0fzOtTiMS2fA7GN7dkVlxWVCLISxkvBWw/g0ub/L5TYt33Vi/T67V/qoX3cDSAEPqjuPQrC7hejwGDknhFW0rWWxbqHfSDhNEhbDvfWJhO1eAVjypLJD8UI4Rg3ENDjrWLDC6YP/TD5yMSoxu3tNmy2CC/N4y1c+lWs=:1.us-east-1.epbACCJLarUaEI78XZoGREJ9LamRjxMH5pM2kZb64rA=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.5

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://s3.us-east-2.amazonaws.com/adobedocumentsign.blob.core.windows.net.web1016754684231/index.html?s=root@nl2k.ab.ca

Do Not Share This Email



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

[54.240.9.5 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.5 listed in dnsbl.ahbl.org]

[54.240.9.5 listed in dnsbl.ahbl.org]

[54.240.9.5 listed in dnsbl.ahbl.org]

[54.240.9.5 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.5 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.5 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.5 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.5 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.5 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.5 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.9.5 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Web/SEO/App spam from Microsoft Outlook PArt 2



--_000_SEYPR06MB5301D044809526EE1685EA86F2E82SEYPR06MB5301apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi there,



I was impressed by the design of your website during my review. However, so=

me errors are preventing it from performing well on Google.



Can I send screenshot of these error?



If Interested, May I send you SEO proposal & price list?



Kind Regards,



--_000_SEYPR06MB5301D044809526EE1685EA86F2E82SEYPR06MB5301apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi there,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I was impressed by the design of your website during my review. However, so=

me errors are preventing it from performing well on Google.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Can I send screenshot of these error?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If Interested, May I send you SEO proposal & price list?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Kind Regards,








--_000_SEYPR06MB5301D044809526EE1685EA86F2E82SEYPR06MB5301apcp_--

Web/SEO/App spam from Microsoft Outlook PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 10:23:00 -0600

Received: from mail-japanwestazolkn19012048.outbound.protection.outlook.com ([52.103.66.48]:64175 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weEk6-000000000Ei-40aK

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 10:22:05 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=OQabNH7+tp3hqbIsyoTe3xYdr65pQHU20Ffdm6oJv+8/OPjxxQOSqOzfCYOFTu8ZyOrqMtzeyp7Msy4kKNWtqPQvCGGLtlvpTi+94wGLttpGFk/XwK/iRraAFBI74pIn9WMvm9b395Lzat/AsFOtVgPoysWFs7liGTmvacPnB9C4vLl1Ruw8JcqJbGngvqiHCLGhh/Yrw+4Ozfuex+TvoqrCeGvMyF8GJOGfi7LzH27m7Imybtq+OLEHbRrl7r4MSzqLQ1azWnglwXMpOj3LwX7bVqjJNxbX11mXwqagcSpIsUb2frOq90sZOb5YonrPa3XxKJ8efWkLT+VYrq75Eg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=2R9qeFWt63i5xC7AgCRPqbFScXQPDu2YGbf0skp1JLk=;

b=jm8li6hkFq8kuLWD7ZFraL2V9BKdk1WWD/qfxtH/OxBaHSCm9TDGW1uN5EwjOdLfJ9NbSfchskMhlY31E78XH3p94eIasABQisy3qw4uGd/97CSywD2hVGW1TpZhYryoY806tQQqaFnF4Am4tJnvmIRpsvWb6toSDA1YVYKrLRuxlBqffjluYEwO1tJIXzxWp1kifrRNNFR+vhDmcGUF7j/8Ukyg4OSc1dt9ehYh1LaPno2UV1TteMKgySs2Ip6+kqRsE/Tv3cfyzF8r24c5ATRrNuJBuw/SSfzdxXtvJlqdPsJ34HY5B6POfTbh9P7BgSwITO7vx0r/eCctA5Sfbw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=2R9qeFWt63i5xC7AgCRPqbFScXQPDu2YGbf0skp1JLk=;

b=maMQLMajjxDcAToc3EJ9WRKffVCaTI+UXTd+lD3oNghOnWJ2cmjl5wW34vJAb1RsiOvKdBIWVdd4K2/x/I02Y9OiIhzomUHqpSpRubSiSQhjwN3TeK1sEKPK/a8yTZRR/BB1/0oOxxCu/d4WFhxkFrRYHDV+nMs5Brbg5cJ+om7h8BUzWC8K4Jl2vN/KrJeXyjYpjg8+AKrpZYi3PMtyR23mgoy9RzpZ2ov4cVZ4XjNSji6EfPwH8IgDRdRFNftViuZpXGko+9xCSrwgTadK2pH6Ae3fJTTc4NzkFwg9JXBbn9qqPRA3hS0fDoKTQ8pLGVL5MM4tPtiL4240JANo3g==

Received: from SEYPR06MB5301.apcprd06.prod.outlook.com (2603:1096:101:82::8)

by SE3PR06MB8762.apcprd06.prod.outlook.com (2603:1096:101:330::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.19; Mon, 29 Jun

2026 16:20:35 +0000

Received: from SEYPR06MB5301.apcprd06.prod.outlook.com

([fe80::d3c4:27db:dfc9:d165]) by SEYPR06MB5301.apcprd06.prod.outlook.com

([fe80::d3c4:27db:dfc9:d165%5]) with mapi id 15.21.0159.018; Mon, 29 Jun 2026

16:20:35 +0000

From: Sehbaj khan

To: Sehbaj khan

Subject: Re: Yes ?

Thread-Topic: Yes ?

Thread-Index: AQHdB+J1WSDgFtQr70eNuUgxsF6w6Q==

Date: Mon, 29 Jun 2026 16:20:35 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEYPR06MB5301:EE_|SE3PR06MB8762:EE_

x-ms-office365-filtering-correlation-id: 853d3dc3-3b55-41da-35c8-08ded5fa5969

x-ms-exchange-slblob-mailprops:

2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3HoMUv4E6giI08ctd5VIGjYqxl6wxfyDFND6WPtQ0SnfGherIpH/OB2d74rI32zOLnuG9cRgCMDZuZuA5Bf9LlQBG9EpQEIt5BXN9kUNQBwfprjGas9Kk4Kc9Vq1J3TTcRue+eStRsoyCu5GWdZ47Ff6WARHdckxmoBEUXjLRyAK7vq60K3ogE6IXablSmnoMpKKDTEqUZzt59TnPsojXWYU4vv+RfX7hY3eRr3Sj/xT614fb5TveehEykgbZDnY1d9tsmzEUlbQIhJlN26QXxDfP2x03gEZbc6Q4WCyNPB/zxt9J3LiLODu6BwMCaAx1cIu6vtq3g9jQ5PVoBFD5OYNaK4DnXWltiQWPeGU4vNSazF8rwbsZm9JE8a78lD5QqO9/pFn4s2UTcjsjKhXc/KhCPhgam/CoKj3CmIn17qFHsXrJZCn/h+U5ESRYhK0Y6ZIwWitLtSyO5YNgFWa5GYTi9v4OGn1dNyQIQTPlqmT8KB+COoOcvPfTbWf9SOJDjvKbYwndYHgdc8oozMfFFn+AYk5iA1z1sBanaye2q9UFclOmRwQHow==

x-microsoft-antispam:

BCL:0;ARA:14566002|16051099003|8062599012|24021099003|19110799012|15080799012|15030799006|39105399006|37011999003|24121999003|22091999003|8060799015|2604032031799003|704163111799003|31061999003|55001999006|25010399006|4140399003|41105399003|39145399003|40105399003|18071099003|26104999009|440099028|3412199025|102099032|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?zvrjSV9rLbtXQQp9w9/4AG+3FfuRg2Fa2VY3C192Bek87krgFr/nDzMNT8?=

=?iso-8859-1?Q?/8DUAnJbDvG4T2dec8ZWV8TR78CGM0sTY/OaD+SFJytJYVoxZPIE27x0ve?=

=?iso-8859-1?Q?YNO8tkA+9ct8sZlNiSwLNl8a9hSCzUazr8/Fli6BTU+rf0UXgjS5cbgTND?=

=?iso-8859-1?Q?qFWL0Q7mfsPbx9dZdqInTb0Y4gwb/VnbmCM/spCZTyE80lfwd+mTaSFnmg?=

=?iso-8859-1?Q?x44LZqPQuLvhnGPDh8lZMTimKfK7XyezUR216WfDIKpVHxHgq2sjI2gdPX?=

=?iso-8859-1?Q?1iC55q0vCOx4HFUUSQVVowaqGRMNi06gYLPbXJO9FhwA1kRadDM5LbFd42?=

=?iso-8859-1?Q?owusRi0r/g0geXcYT30XNVO26NRwfOTgYzS3Jdgf1OKW9o3ENJ8oVKwIic?=

=?iso-8859-1?Q?mCDD8ScDjAA0fOBX3BM/GYQJ3kKHyD0DAbR8L1d8SOwjX17p4OZGmUITn9?=

=?iso-8859-1?Q?6smutk6GB90/0YRQ47E66mzluLK2EKXsgizxw/kcSySNBsVsWA19rPHroB?=

=?iso-8859-1?Q?129jXkOYSzq3bC5z3pD9M19aVDlg9z0gBtOaNXZCtSO1CS99IE/eLGcOI+?=

=?iso-8859-1?Q?gakQ/F5ulWWhAtcIRypCqSFiXNT11r0c6Oh52AGbidKquGNmIsB8UzR/yP?=

=?iso-8859-1?Q?Y+qHvy0wWQscU8xq7iLgllJotX54R5CAEf86Dg/H/Mu9DCv2Xwt/uhORZz?=

=?iso-8859-1?Q?fokcXvY26dtI9oQeG3F+p4OqencNMSj2dmWtyAGxO0E4jGDIkM8xj/3dwe?=

=?iso-8859-1?Q?8kZ30+wgep1ixJ0iXSwHs9BHGPaEw6JdTpJQIFMrlWZwe8z3dCTWjnCYCA?=

=?iso-8859-1?Q?wrWZiVfkuEQk3qT8G/VVZ9HwDog9LZ7mgVujkvT9WgM8TYtsCDlAXufBYk?=

=?iso-8859-1?Q?410RnLxfwlHoflJC1L/+dojlOsoLIrO0kU/YL1mQK5eXX2BK0i6hCX5qUZ?=

=?iso-8859-1?Q?O9pH1Uzd9hq/rW53yv+iM7XTgHHT3+xBbJgtfmmMs9JzSGNUpKc7rmhs1G?=

=?iso-8859-1?Q?SNlHAHWVAxa1gkoiWLYTxlwb4mPPAekEqpf529nOSIZy8LtyhLoUYYU1TO?=

=?iso-8859-1?Q?WgBSb3LVgpOodsInlpGG59ecd95doLgxQXpS1VWMAd2a3zPq+3oBG2nHJ1?=

=?iso-8859-1?Q?VUC/l4o3+mELthls8Awcpmz02M9y+PbUEH8AkgQLddIg91l98dXZ/NtCfn?=

=?iso-8859-1?Q?2g/IYTlLOpFuKnCsNrzkVI+7xGVsvBH6JH7/IUFd1L4xXqbNTVLynVkSOj?=

=?iso-8859-1?Q?kGGqX9IfNqlPwy7ROZT7R2jeGR3jzTBC+Osf38DRy+JjBnLFFKlKZkbGhm?=

=?iso-8859-1?Q?2ZLCaXxXbRDjelOs6heOEAEhXUyyjU0KJ777GB4FrC7vxYvVJ5IHsUdJ0g?=

=?iso-8859-1?Q?9IqpZLyZ7Y/oFVnJZ9JG6jgqikfRhrEg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?V7fMHZcx1YyP/ofgB7Vy2WVk47pN1bZr89rIOAeu5H1hdiKjQi1KHuDslX?=

=?iso-8859-1?Q?wKe7m3kvCQUSlW/jnBVLQetSACfrmBGVpFokXiYj4GCg4OzJLht3yEqo7v?=

=?iso-8859-1?Q?srMiowWq0b1vB+b7Z2btgHwJiOaCWMXYHHT680nHPTBBcPmEMLX57KqB6S?=

=?iso-8859-1?Q?my3KqLa58O7qLYsWFaj4pDHgjYBuE1/3ast4DHQPt0/wQ/Fai3tkNXgid1?=

=?iso-8859-1?Q?bSD+U6E02yxOSyfkeUgu8btFSLFFyL4KpcCKE2k0SPJuXkXc0kodwuIuL0?=

=?iso-8859-1?Q?lzIa/7u4/HexLWvgnpeG3xTMwZrp5eetDcqtg4AZiFecxja5QUIBrURkmW?=

=?iso-8859-1?Q?N2emskGBGNdujZd6nCpClN0n3bpEnGYqWqnipCPoxQcAHq5J1nJbctHYU6?=

=?iso-8859-1?Q?7JekPLVvskeGzdjlUKLDlngc7ILimWd6YeZBlUMX3thqIYUhtB31EMYuDT?=

=?iso-8859-1?Q?LMEkm0P1zRXb1VoRZ+FD1TNNVVaGcCm5SS94Wgu2cP6L+NdnzVN3bgNuxc?=

=?iso-8859-1?Q?pV13ZK3u51Ag2vVdc8doYyhyw9/lKZ3QAG8pAYDZddAO+nRoQzQiSv7ogC?=

=?iso-8859-1?Q?5uERIGufRJOmENmd/g4Bd/rQvMe+f6DKFY0k4+/kKd7mpVTn3JnvdbDd0Q?=

=?iso-8859-1?Q?VPUBLhQLbcNImhKQmX2cq2RO+glesJIzaYaSW93HGw5GKH0za4SdQ7yudd?=

=?iso-8859-1?Q?deVPWACTlszxUPc/lQ1aolc2zmOOnjqGCBUh6Wl4X84FS4tsnB+iZFT8pT?=

=?iso-8859-1?Q?TY3jltGX0w9F8K3MUvyHydZLW7RD2jEDiVgwORgY5r9f1Grj0SZC8wyae3?=

=?iso-8859-1?Q?51T3kVUkJ1TQXrBGNAh0fzsjQ5y6/ZuLYZw1ZmaTLYCD7VC4wRc+zQnFxa?=

=?iso-8859-1?Q?NPwo137Y/ZPJuYQv5bQ8IJWsY3peIlD3qKv3KUFfPO73FnZQW1cGwa53zo?=

=?iso-8859-1?Q?1gGOSLlNz2shIzLbHbxjmjSPifDzR7ip7R91mU4RN7g406xnpu5yCvQWhU?=

=?iso-8859-1?Q?qneB44/3XkL6OG6ObE6+pQi+W+cIAprV/KvRwCirUFEiahlhumUa9FjzGU?=

=?iso-8859-1?Q?EF3qFp3ti7bBfZ6iBfg2rpniurINWlZTxbRohVVtVA0iFfe7ulKwP4m+oL?=

=?iso-8859-1?Q?IBNUDsEFGw6aMW+P79IAhF9527Ae+hudBDKcjhy2fWU8n2VLNvKOGM+oaF?=

=?iso-8859-1?Q?ahx4UK+JWsPe1kzq9LEiBZ7kifDbrNTDisWldpFkbm9phZTjEkwk4orm/6?=

=?iso-8859-1?Q?heBl96gx6ZyZ4BXZBYd02YtE5e+9qdk+O5ZZQLd/1TcqXsqsYcLPaJwqcI?=

=?iso-8859-1?Q?BDwWqK0hr0MRfyYud4uxRxuRKcjE4tVeES+U60OxRZOr1AhEK2cqXE7pt+?=

=?iso-8859-1?Q?hnF+Gew0teG/a6Oe7g7UEcy7o6a77asjEJwIkSjpgqWRmTS4fMTNmwFgrN?=

=?iso-8859-1?Q?inNxVE5NTRevHygck6YqPZiBXkBzMvdtRlJqvHxLcLM5wIq/6HRAyrteeo?=

=?iso-8859-1?Q?yuy3O045EQLhKTE9h0P/qv?=

Content-Type: multipart/alternative;

boundary="_000_SEYPR06MB5301D044809526EE1685EA86F2E82SEYPR06MB5301apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEYPR06MB5301.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 853d3dc3-3b55-41da-35c8-08ded5fa5969

X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jun 2026 16:20:35.1415

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE3PR06MB8762

Web/SEo/App spam from Google Gmail Part 2





--0000000000006d00fb0655625337

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




rif">God day,


gia, serif">I wanted to follow up in case you missed my earlier email.
t>

Let=

me know if you'd like to review our packages and pricing.

p>

Best Regar=

ds,

Robert


<=

div class=3D"gmail_quote gmail_quote_container">

mail_attr">On Thu, Jun 18, 2026 at 8:28=E2=80=AFPM Robert <
ilto:r87284545@gmail.com">r87284545@gmail.com
> wrote:

kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=

1px solid rgb(204,204,204);padding-left:1ex">

=3D"font-family:georgia,serif">Hi,


erif">

orgia,serif">I still have the notes I prepared on improving your search vis=

ibility.



mily:georgia,serif">Would you like m=

e to send over the details?

=

Kind regards,

font-family:georgia,serif">Robert=



_attr">On Wed, Jun 17, 2026 at 5:18=E2=80=AFPM <
545@gmail.com" target=3D"_blank">r87284545@gmail.com
> wrote:

v>

r-left:1px solid rgb(204,204,204);padding-left:1ex">


5,255)">Hi,


gb(34,34,34);font-size:small;background-color:rgb(255,255,255)">
=3D"tahoma, sans-serif">After reviewing your website, I found a few opportu=

nities that may help increase organic traffic and leads.


=3D"color:rgb(34,34,34);font-size:small;background-color:rgb(255,255,255)">=

Interested in seeing them?<=

/p>


,255,255)">Best regards,
Robert
=











--0000000000006d00fb0655625337--

Web/SEo/App spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 07:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weBus-00000000Ax3-2KrQ

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 07:20:50 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 07:20:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f51.google.com ([74.125.82.51]:52556)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1we9h8-000000007Z7-0hgk

for sales@nk.ca;

Mon, 29 Jun 2026 04:58:39 -0600

Received: by mail-dl1-f51.google.com with SMTP id a92af1059eb24-139edc6bfc0so5538093c88.1

for ; Mon, 29 Jun 2026 03:57:41 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782730655; cv=none;

d=google.com; s=arc-20260327;

b=Eh5ZBlaedHCFJku/jRyMvDbi29LT2WalME9ey+Y/K/fdtLDmaTk0U33fFVyRgAS8L4

3zDTOFjGH0VfRcgy8zxmjC1g+SN25HO8uBbtRU2g9fa29y+F+Zh58V8pxG/qf+1GStsU

eWklVEe35EuNVjvrnuUA0qbg6vELM17ymyGpQHp/KQALc9c2sce3ukWuxPiIUTUZOEii

quuBp6HQE1+gQLwWBN+bWhy3jNAt/ttDDb84FEbsYaH5V4z/CA/NOmKUJxAcAMak4gTK

/xGHpUJhaS4ZKNJnhLLVPMxSipW5iQwAVRivpBtdNuimpmSH3I9VUWTliDjv7t1s9Xm3

YzXw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=SB6iLFq7WJdwKet+naihoFp0L0pklJFXZXBmIR/yQTQ=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=hzfleFpvX/Mc7VRYOpOcmEAQgTQAZuqEDrWAHMylYCNnd3rMM2wFt9TaB3L6JQJRw1

jlNd6vHq7gJQME5H96Ep6v86UMQ+Lm9XrLrlgdVxdFYqGoDmzqgWgXTXqUQvLj8K9ka0

eThq23kAkb4MJO7T1QF0ED4BrgCibIl5jqxf0sunBCpseOfh5xkKjGS59FwUchy0AMNy

VtQ4dkr/RFE0dtpwXtDJ3CSFeN4FaYgLAac2hawQeWoK7zwG6VWz/vaQVjJjHUEiAFeO

sqdHFEdvqU/QJpoLfrlnUhXHGAKIg9sLGmgz1YJRoeUNvy3zKwhn5z0025d0ppZauL9m

+QbA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782730655; x=1783335455; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=SB6iLFq7WJdwKet+naihoFp0L0pklJFXZXBmIR/yQTQ=;

b=qlCVs7uOpBokK1Ib1sK8ImtxijusbnQEHdK0frAhCSkCDbDOVirgfYoq2d95iY5/5L

aUURpYZPxPgxMY6/28G9teJdqdQhsp63zGr7ccIXoc3tFhIQvgn5d+/xJWgnwS6sPy4t

To8bCy2b8TJJOPH1yGd+XtcFFuDmALiH2D5+ke35kw2BYiRbsSIt4XRCaw6rbF3tyqyp

dg/DWJzyun0F9ldbMHFiQM/BVd1Og+U6hZo+YaU6B45CMr9n8aItiquk4y4mBtriGX6d

eP7IYM+Vj3rxEd5JxKJgyaCTuxn6X8OtoJ1oojrNPJV97m7dRB3EnmtsBsN1GgXbLtb7

vfEA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782730655; x=1783335455;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=SB6iLFq7WJdwKet+naihoFp0L0pklJFXZXBmIR/yQTQ=;

b=kjwg8eEzAiiDcSpXpNgnqbWh2oVfqtQ2ReoNGRosRY6vEBaZKnJNFnw0rT+cI6pz+Q

eks1VvckwFKVCZkWLDOgtbmnI/u3jGdv6PxCBGWhQi9oZ1Lye6ATl1fTpBZ1vcRm8+tC

xZu0AX3Dz/ox5lCk0WsCJjUpG+kiDhuLGyjD0NzwLG63Ex51SwhzYY23OJbYABw5JDFI

zfZNCDhzLKbVLsEJ83CbYj6Fhbwp//V7Ie4IDogoc4Rf2E6BoP/eOX+4KtWkezTTNI3N

yl2EcGyCgdkf9kIq7RcW50m/W2HqK6hcMei04uOGRuN74NqOfJsuzgUZJ7z7HhG7LMG2

Ux2A==

X-Gm-Message-State: AOJu0YxG473GBmgN/LDifgyRIyc4viY1Cio7ELkJdcENsTBMxkNkZZ7d

pOXie1uRQ5SMBKFwaHfBQEwRLhnvGNoFC+x7jFYvqUByRMIw2GCE3qIIJjNiRQIrPB9Tu9k6OuI

LdRESC6rhNYY18zmJsU2bOy39LAYrPOAKTe8oLWfWcdSZ

X-Gm-Gg: AfdE7cniSDHapq/gi65pr+UUYOQqVs5aMlL/azpOHk+EUGiBtYAPC47CV700ty97i+k

pwcCfp5eetYzBPxQOXMIoTLRHeSyf/7fGosesuY7yY3gQBbTDyhvAk/FzeMIg2xaOfbIRYajD+v

XtI6oIDp8Kg80WQ99Zoh5/iUumriowmsttHNFbbX//J6uK5RtUmuZV99zT+C6ruyw26H/rR1/bb

suiXZgDMz+5riXCUdEQrvKj6fRcCf30t+0RfBb92vp5o8sF80f5vDkPsAaJeUuUq93bhEJeNEru

VnBIWqbfjA8X8GLfR+5td9uXGSw7EpYdOpt9QA2GpjdlMbuxUGhan4OAP9yTXnu4qA==

X-Received: by 2002:a05:7022:ec82:b0:137:f0d8:4ffe with SMTP id

a92af1059eb24-139dbb5da1bmr12600678c88.36.1782730655070; Mon, 29 Jun 2026

03:57:35 -0700 (PDT)

MIME-Version: 1.0

References:



In-Reply-To:

From: Robert

Date: Mon, 29 Jun 2026 16:27:23 +0530

X-Gm-Features: AVVi8Cc8Uid4JDQDCWMqaSdqyYMXbOJAa49bH4WGl7d0H-XXCxzx0ikZBptowOs

Message-ID:

Subject: Re:

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000006d00fb0655625337"



--0000000000006d00fb0655625337

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



God day,



I wanted to follow up in case you missed my earlier email.



Let me know if you'd like to review our packages and pricing.



Best Regards,



Robert



On Thu, Jun 18, 2026 at 8:28=E2=80=AFPM Robert wrote:



> Hi,

>

> I still have the notes I prepared on improving your search visibility.

>

>

> Would you like me to send over the details?

> Kind regards,

> Robert

>

> On Wed, Jun 17, 2026 at 5:18=E2=80=AFPM wrote:

>

>> Hi,

>>

>> After reviewing your website, I found a few opportunities that may help

>> increase organic traffic and leads.

>>

>> Interested in seeing them?

>>

>> Best regards,

>> Robert

>>

>

Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: daVE@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 07:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weBqe-000000006oO-3wRw

for daVE@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 07:16:28 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 07:16:28 -0600

Resent-Message-ID:

Resent-To: daVE@doctor.nl2k.ab.ca

Received: from mail-m4785125172.xmail.ntesmail.com ([47.85.125.172]:29986)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1we4eG-00000000JA7-3xZc

for sales@nk.ca;

Sun, 28 Jun 2026 23:35:22 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_907538_1774091706.1782711190485"

To: sales@nk.ca

Reply-To: Annie@loffepet.cn

Subject: =?UTF-8?B?VGFwIEhlcmUgdG8gRXhwbG9yZSBQcmVtaXVtIFBldCBUb3lz?=

X-Priority: 3

MIME-Version: 1.0

Received: from lina@loffepet.cn( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 29 Jun 2026 13:33:10 +0800 (GMT+08:00)

From: Annie

Date: Mon, 29 Jun 2026 13:33:10 +0800 (GMT+08:00)

X-WM-Tid: 0a9f11de03cc080ckunm7caefa7b121bb3

Message-ID:



HI,



Hope this email finds you well.



Our factory's strength is cat/dog products-durable, safe, stylish felt designs.

All products hold BSCI, ISO, and FSC certifications.



Advantages:

1. Fast delivery via the factory location

2. Stable quality, competitive prices

3. OEM & ODM customization.



We aim for a trust-based partnership, not just sales. Contact me anytime for catalogs, quotations or discussion.

Looking forward to your reply.



Best Regards,

Annie































Nigerian spam Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 07:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weBn1-0000000007e-3Fdp

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 07:12:43 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 07:12:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-outd.mail.t-online.hu ([195.228.240.56]:25083)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1we30U-00000000BrT-48vv

for sales@nk.ca;

Sun, 28 Jun 2026 21:50:13 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=t-online.hu; s=mail;

t=1782704880; bh=686ReW5847c9+QCUVq6Q/a8L+n9pSApuBwVs3+KOXTI=;

h=Date:From:To:Subject:Reply-to;

b=jny4g8axAN28KQ7cLVBQKKWAkEq0dqYsICRFAvVTfb8GUzIXtWzpYNkvgnrgqJYQb

U7jL5KB+FiiACfKoNbZY/EreAGoc9JoV2CB+mGxBrmYWlUNEMGkmBazMQj27Q722GP

Pok+FYmRytEXZ8aVdKlcIb+bSxEGiChxDKZDxYZ4z8P2V1gJfk6wb3JJrgwLKfFxXH

mM6dlk5RWZc4zLK9fwtuk3yCuOdIEcEv1itrs+byhiv2AOHFO+P7ZcvNuD0Jjpb9rM

udlMeIe5PFh+V4PJcJS9IofryxOgbjeYqbEKIFqlqMfPbPOIkpJshPuCVNvIiQWEC5

3hkEEnyNZueaQ==

Received: from maxwm03a.mail.t-online.hu (maxwm03a.mail.telekom.hu [195.228.240.101])

by mail-outd.mail.t-online.hu (Postfix) with ESMTP id 4gpXFH0vm8zDrDC;

Mon, 29 Jun 2026 05:43:46 +0200 (CEST)

Received: from public-nat-01.vpngate.v4.open.ad.jp

(public-nat-01.vpngate.v4.open.ad.jp [219.100.37.233]) by webmail.telekom.hu

(Horde Framework) with HTTP; Mon, 29 Jun 2026 05:47:59 +0200

Date: Mon, 29 Jun 2026 05:47:59 +0200

Message-ID: <20260629054759.Horde.5XpDEMuGFi1gE9MYFR9hACj@webmail.telekom.hu>

From: Olena Zelenska

To: me@gmail.com

Subject: N41-

Reply-to: olenazelenska68@gmail.com

User-Agent: Horde Application Framework 5

Content-Type: text/html; charset=utf-8

Content-Description: HTML =?utf-8?b?bGV2w6ls?=

MIME-Version: 1.0

Content-Disposition: inline

X-VadeSecure-Status: Legit

X-VadeSecure-Score: 0

X-VadeSecure-Verdict: Legit

Authentication-Results: iprev=notverified ip=195.228.240.101;

spf=notverified client-ip=195.228.240.101 smtp.mailfrom=attila6303@t-online.hu;

dkim=notverified (), header.i=;

dmarc=notverified

Received-SPF: SPF not checked

X-VadeSecure-Status: Legit

X-VadeSecure-Score: 0

X-VadeSecure-Cause: gggruggvucftvghtrhhoucdtuddrgeefhedrtddtgddvheekgeefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuofetifgjteftvffgnffgmffqofdpucfqfgfvnecuuegrihhlohhuthemuceftddtnecunecujfgurhephffvufhrfggtgggusehhtddttddtreejnecuhfhrohhmpefqlhgvnhgrucgkvghlvghnshhkrgcuoegrthhtihhlrgeifedtfeesthdqohhnlhhinhgvrdhhuheqnecuggftrfgrthhtvghrnhepudfgieejtdefkeevleelgfehkedvkedvffeihfdtvefhtdegveffgffhtdegfeevnecukfhppeduleehrddvvdekrddvgedtrddutddupddvudelrddutddtrdefjedrvdeffeenuceurggutfgvphhuthfkphepvdduledruddttddrfeejrddvfeefnecuvehluhhsthgvrhfuihiivgephedtnecurfgrrhgrmhepmhhouggvpehsmhhtphdpihhnvghtpeduleehrddvvdekrddvgedtrddutddupdhhvghlohepmhgrgiifmhdtfegrrdhmrghilhdrthdqohhnlhhinhgvrdhhuhdpmhgrihhlfhhrohhmpegrthhtihhlrgeifedtfeesthdqohhnlhhinhgvrdhhuhdpnhgspghrtghpthhtohepfedupdhrtghpthhtohepmhgvsehgmhgrihhlrdgtohhmpdhrtghpthhtohepshgrlhgvshesmhgrnhgtohhmrdgtrgdprhgtphhtthhopehsrghlvghssehmrghrthgvtgdrtggrpdhrtghpthhtohepshgrlhgvshesmhgrthhrihigthgvtghhnhholhhoghihrdgtrgdprhgtph

htthhopehsrghlvghssehmrghtthhitgdrtggrpdhrtghpthhtohepshgrlhgvshesmhgrthhtphgrrhhkvghsrdgtrgdprhgtphhtthhopehsrghlvghssehmugguohhulhhtohhnshdrohhnrdgtrg

X-VadeSecure-Verdict: Legit

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings. This is Mrs. Olena Zelenska, I am contacting you

based on my personal interest to develop a mutual businesRelationship with

you in your country or your company. which I believe we could mutually benef

[...]



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[219.100.37.233 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.101 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

[195.228.240.56 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[219.100.37.233 listed in dnsbl.ahbl.org]

[219.100.37.233 listed in dnsbl.ahbl.org]

[219.100.37.233 listed in dnsbl.ahbl.org]

[219.100.37.233 listed in dnsbl.ahbl.org]

[195.228.240.101 listed in dnsbl.ahbl.org]

[195.228.240.101 listed in dnsbl.ahbl.org]

[195.228.240.101 listed in dnsbl.ahbl.org]

[195.228.240.101 listed in dnsbl.ahbl.org]

[195.228.240.56 listed in dnsbl.ahbl.org]

[195.228.240.56 listed in dnsbl.ahbl.org]

[195.228.240.56 listed in dnsbl.ahbl.org]

[195.228.240.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[219.100.37.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[219.100.37.233 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[219.100.37.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[219.100.37.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[195.228.240.56 listed in bb.barracudacentral.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[219.100.37.233 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.228.240.56 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[olenazelenska68(at)gmail.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} N41-





Nigerian spam Part 2



Greetings.



 




This is Mrs. Olena Zelenska, I am contacting you based on my personal interest to develop a mutual businesRelationship with you in your country or your company. which I believe we could mutually benefit from.




 




Please reply urgently for more details




 




Regards,




Olena Zelenska




 




 




Please Note: if you receive this email in your junk or spam folders, please note it’s because of your internet ISP. Please mark it as not spam or move it to your inbox to reply




Customs Phish from OVH

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 28 Jun 2026 19:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1we0sh-00000000Etj-1cjC

for dave@doctor.nl2k.ab.ca;

Sun, 28 Jun 2026 19:33:51 -0600

Resent-From: The Doctor

Resent-Date: Sun, 28 Jun 2026 19:33:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [15.235.216.184] (port=57832 helo=mail.canvas-otp.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wdvuc-000000004ZF-2hhE

for sales@nk.ca;

Sun, 28 Jun 2026 14:15:39 -0600

Received: from mail.canvas-otp.com (localhost [127.0.0.1])

by mail.canvas-otp.com (Postfix) with ESMTP id 4gpLGv34WMz1LK4V

for ; Sun, 28 Jun 2026 20:14:31 +0000 (UTC)

Authentication-Results: mail.canvas-otp.com (amavis); dkim=pass (2048-bit key)

reason="pass (just generated, assumed good)" header.d=canvas-otp.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=canvas-otp.com;

h=content-transfer-encoding:content-type:mime-version

:message-id:subject:from:to:date; s=dkim; t=1782677670; x=

1785269671; bh=p1AeP5GOLOiwkwXwFI1ZEQN+BT5Yn7WIqqEuS2zZS1M=; b=Q

z5Q9xcdJiHA68xuxWR92Ci3YFGWb4EjkzikBshkL05XBrr39mjM1kmF+ZFJnG89S

adyM+qGt7jKqKzlB8jlaHqIcOSKeJcf9wu4STlS86qoPpJr6dAltmTVy1/xTqz8S

wDxPcYwYqkqc2PoBWIQu2b1BqXxl/c5eXxEsiKxQSognw/hcEAM+0PMhO2psXfQm

T0kekuSNDrgr3Grhbuh8JzzzBvrnuPxhgUgYQ1ow7uQbvLETxohreFG7TJELWX06

fjgiJYoUH4dcxrzUpZDgwUdsJqbYmFpD2V5FaXqPbuiBf+seH9HT78+j6gSAsOMN

ODfseozV3kdV1KVPuEt4g==

X-Virus-Scanned: amavis at mail.canvas-otp.com

X-Spam-Flag: NO

X-Spam-Score: 3.166

X-Spam-Level: ***

X-Spam-Status: No, score=3.166 tagged_above=2 required=6.2

tests=[ALL_TRUSTED=-1, FSL_BULK_SIG=0.001, HTML_FONT_LOW_CONTRAST=0.001,

HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=2.43, RAZOR2_CHECK=1.729,

TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001, URIBL_BLOCKED=0.001,

URIBL_DBL_BLOCKED_OPENDNS=0.001] autolearn=no autolearn_force=no

Received: from mail.canvas-otp.com ([127.0.0.1])

by mail.canvas-otp.com (mail.canvas-otp.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id hxQ54Gfr7qJB for ;

Sun, 28 Jun 2026 20:14:30 +0000 (UTC)

Received: from 127.0.0.1 (unknown [196.119.213.60])

by mail.canvas-otp.com (Postfix) with ESMTPSA id 4gpLGr4C3Bz1LJlM

for ; Sun, 28 Jun 2026 20:14:28 +0000 (UTC)

Date: Sun, 28 Jun 2026 22:01:48 +0200

To: sales@nk.ca

From: Ittelcam

Subject: =?UTF-8?Q?Delivery_Update_=E2=80=93_Action_Required_for_Your_Shipment?=

Message-ID: <4b4314d47b2bb16fe5fc45309d3ac444@canvas-otp.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="11a931b24499bc0249625a7e271427724"

Content-Transfer-Encoding: 7bit



This is a multi-part message in MIME format.



--11a931b24499bc0249625a7e271427724

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

















Intelcom=20



Dear Customer,=20





Goods imported into Canada may be subject to applicable duties and/or tax=

es. Carriers are authorized by the CBSA (Canada Border Services Agency) t=

o process occasional shipments on behalf of the importer or owner and may=

remit applicable duties and taxes.=20

However, a parcel belonging to you has been held by customs due to missin=

g declaration details from the sender. Please pay 2.96 CAD in duties and =

taxes as soon as possible using the button below:=20



Schedule my delivery=20



Thank you for choosing Intelcom.=20









This email was sent by an automated system. Please do not reply.=20

=C2=A9 2026 Intelcom Express - Dragonfly Express. All rights reserved.=20





--11a931b24499bc0249625a7e271427724

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable




x; PADDING-RIGHT: 0px" cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bor=

der=3D0>






TABLE>







--11a931b24499bc0249625a7e271427724--






x; box-shadow: 0 4px 8px rgba(0,0,0,0.1)" cellSpacing=3D0 cellPadding=3D0=

width=3D600 border=3D0>





=


















; PADDING-LEFT: 15px; PADDING-RIGHT: 15px" align=3Dcenter>
FONT-SIZE: 28px; FONT-WEIGHT: bold; COLOR: #ffffff">Intelcom

TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px" align=3Dcenter>Dear C=

ustomer,

TOP: 0px; PADDING-LEFT: 25px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 25px">

Goods imported into Canada may be subje=

ct to applicable duties and/or taxes. Carriers are authorized by the
ONG>CBSA (Canada Border Services Agency) to pro=

cess occasional shipments on behalf of the importer or owner and may remi=

t applicable duties and taxes.



However, a parcel belonging to you has =

been held by customs due to missing declaration details from the sender. =

Please pay 2.96 CAD in duties a=

nd taxes as soon as possible using the button below:


14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; FONT-WEIGHT: bold; COLO=

R: #ffffff; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; =

DISPLAY: inline-block; PADDING-RIGHT: 25px; border-radius: 5px" href=3D"h=

ttps://novachem.fr/">Schedule my delivery

TOP: 0px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px" align=3Dcenter>Thank y=

ou for choosing Intelcom.



x" cellSpacing=3D0 cellPadding=3D0 width=3D600 border=3D0>






NG-TOP: 20px; PADDING-LEFT: 20px; LINE-HEIGHT: 1.5; PADDING-RIGHT: 20px" =

align=3Dcenter>

This email was sent by an automated syst=

em. Please do not reply.



=C2=A9 2026 Intelcom Express - Dragonfly Express=

. All rights reserved.

Mon Tue Wed Thu Fri Sat Sun
Back June '26 Forward
17
23
30          

Archives

Categories

Syndicate This Blog

  • XML

Blog Administration

Open login screen

Powered by

NetKnow Navigation

Home


VPNs


Dialup Service


Web Design


Web Hosting


E-Commerce


Server Colocation


Domain Registration


Web Mail


Support


Testimonials




Client List


FAQs


Interested in NetKnow Services?


Links


Disclaimer


Acceptable Use


Security





Technorati Profile







AddThis Feed Button

Remote RSS/OPML-Blogroll Feed

No RSS/OPML feed selected

Error

serendipity error: could not include serendipity_plugin_statistics:9cbc0e29a86fd9359ac6748399d6ba5b - exiting.

addthis





AddThis Social Bookmark Button










Blog Grade for www.nk.ca/blog

Empire Avenue





Syndicate This Blog

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:7aefbb7ca9b764849be35e938b6fc9b2 - exiting.

Error

serendipity error: could not include serendipity_plugin_twitter:c7a92f670894afa9e3097574359fe38d - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:8b72cc4261ddc7ff15df253b17c29c23 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:a0bd1a65cd9ff1c3e289829cc26557c4 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:dcd26c048e45c234c054530ef1492953 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:6d4c66aeb83aeb9524a7cc609051cf0f - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:acc1042e790905e499445a6890081492 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:158fb50035b12269ec43107b29253af3 - exiting.

Error

serendipity error: could not include serendipity_plugin_topreferers:6b7e3336713d0a60294c7e310ca5cf1a - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:d3f047ee6f925c138fae56dcd7a99400 - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:5544ace5c8b19bb8592464810b48df10 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:5624ac0b69cdbe32d0cdc40814d7eb41 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:b8387d3a378247c1c9ede46fffb084e1 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:bacdc0652131449ebc68ebde2bcb9ce2 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:8c84ca587b64b627d986e9d5ce98ead1 - exiting.